if_tun.c revision 144389 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*-
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 144389 2005-03-31 12:19:44Z phk $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mac.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/fcntl.h>
33#include <sys/filio.h>
34#include <sys/sockio.h>
35#include <sys/ttycom.h>
36#include <sys/poll.h>
37#include <sys/selinfo.h>
38#include <sys/signalvar.h>
39#include <sys/filedesc.h>
40#include <sys/kernel.h>
41#include <sys/sysctl.h>
42#include <sys/conf.h>
43#include <sys/uio.h>
44#include <sys/malloc.h>
45#include <sys/random.h>
46
47#include <net/if.h>
48#include <net/if_types.h>
49#include <net/netisr.h>
50#include <net/route.h>
51#ifdef INET
52#include <netinet/in.h>
53#endif
54#include <net/bpf.h>
55#include <net/if_tun.h>
56
57#include <sys/queue.h>
58
59/*
60 * tun_list is protected by global tunmtx.  Other mutable fields are
61 * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is
62 * static for the duration of a tunnel interface.
63 */
64struct tun_softc {
65	TAILQ_ENTRY(tun_softc)	tun_list;
66	struct cdev *tun_dev;
67	u_short	tun_flags;		/* misc flags */
68#define	TUN_OPEN	0x0001
69#define	TUN_INITED	0x0002
70#define	TUN_RCOLL	0x0004
71#define	TUN_IASET	0x0008
72#define	TUN_DSTADDR	0x0010
73#define	TUN_LMODE	0x0020
74#define	TUN_RWAIT	0x0040
75#define	TUN_ASYNC	0x0080
76#define	TUN_IFHEAD	0x0100
77
78#define TUN_READY       (TUN_OPEN | TUN_INITED)
79
80	/*
81	 * XXXRW: tun_pid is used to exclusively lock /dev/tun.  Is this
82	 * actually needed?  Can we just return EBUSY if already open?
83	 * Problem is that this involved inherent races when a tun device
84	 * is handed off from one process to another, as opposed to just
85	 * being slightly stale informationally.
86	 */
87	pid_t	tun_pid;		/* owning pid */
88	struct	ifnet tun_if;		/* the interface */
89	struct  sigio *tun_sigio;	/* information for async I/O */
90	struct	selinfo	tun_rsel;	/* read select */
91	struct mtx	tun_mtx;	/* protect mutable softc fields */
92};
93
94#define TUNDEBUG	if (tundebug) if_printf
95#define	TUNNAME		"tun"
96
97/*
98 * All mutable global variables in if_tun are locked using tunmtx, with
99 * the exception of tundebug, which is used unlocked, and tunclones,
100 * which is static after setup.
101 */
102static struct mtx tunmtx;
103static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
104static int tundebug = 0;
105static struct clonedevs *tunclones;
106static TAILQ_HEAD(,tun_softc)	tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
107SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
108
109static void	tunclone(void *arg, char *name, int namelen, struct cdev **dev);
110static void	tuncreate(struct cdev *dev);
111static int	tunifioctl(struct ifnet *, u_long, caddr_t);
112static int	tuninit(struct ifnet *);
113static int	tunmodevent(module_t, int, void *);
114static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
115		    struct rtentry *rt);
116static void	tunstart(struct ifnet *);
117
118static d_open_t		tunopen;
119static d_close_t	tunclose;
120static d_read_t		tunread;
121static d_write_t	tunwrite;
122static d_ioctl_t	tunioctl;
123static d_poll_t		tunpoll;
124
125static struct cdevsw tun_cdevsw = {
126	.d_version =	D_VERSION,
127	.d_flags =	D_PSEUDO | D_NEEDGIANT,
128	.d_open =	tunopen,
129	.d_close =	tunclose,
130	.d_read =	tunread,
131	.d_write =	tunwrite,
132	.d_ioctl =	tunioctl,
133	.d_poll =	tunpoll,
134	.d_name =	TUNNAME,
135};
136
137static void
138tunclone(void *arg, char *name, int namelen, struct cdev **dev)
139{
140	int u, i;
141
142	if (*dev != NULL)
143		return;
144
145	if (strcmp(name, TUNNAME) == 0) {
146		u = -1;
147	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
148		return;	/* Don't recognise the name */
149	if (u != -1 && u > IF_MAXUNIT)
150		return;	/* Unit number too high */
151
152	/* find any existing device, or allocate new unit number */
153	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
154	if (i) {
155		/* No preexisting struct cdev *, create one */
156		*dev = make_dev(&tun_cdevsw, unit2minor(u),
157		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
158		if (*dev != NULL) {
159			dev_ref(*dev);
160			(*dev)->si_flags |= SI_CHEAPCLONE;
161		}
162	}
163}
164
165static void
166tun_destroy(struct tun_softc *tp)
167{
168	struct cdev *dev;
169
170	/* Unlocked read. */
171	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
172	    ("tununits is out of sync - unit %d", tp->tun_if.if_dunit));
173
174	dev = tp->tun_dev;
175	bpfdetach(&tp->tun_if);
176	if_detach(&tp->tun_if);
177	destroy_dev(dev);
178	mtx_destroy(&tp->tun_mtx);
179	free(tp, M_TUN);
180}
181
182static int
183tunmodevent(module_t mod, int type, void *data)
184{
185	static eventhandler_tag tag;
186	struct tun_softc *tp;
187
188	switch (type) {
189	case MOD_LOAD:
190		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
191		clone_setup(&tunclones);
192		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
193		if (tag == NULL)
194			return (ENOMEM);
195		break;
196	case MOD_UNLOAD:
197		EVENTHANDLER_DEREGISTER(dev_clone, tag);
198
199		mtx_lock(&tunmtx);
200		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
201			TAILQ_REMOVE(&tunhead, tp, tun_list);
202			mtx_unlock(&tunmtx);
203			tun_destroy(tp);
204			mtx_lock(&tunmtx);
205		}
206		mtx_unlock(&tunmtx);
207		clone_cleanup(&tunclones);
208		mtx_destroy(&tunmtx);
209		break;
210	default:
211		return EOPNOTSUPP;
212	}
213	return 0;
214}
215
216static moduledata_t tun_mod = {
217	"if_tun",
218	tunmodevent,
219	0
220};
221
222DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
223
224static void
225tunstart(struct ifnet *ifp)
226{
227	struct tun_softc *tp = ifp->if_softc;
228	struct mbuf *m;
229
230	if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
231		IFQ_LOCK(&ifp->if_snd);
232		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
233		if (m == NULL) {
234			IFQ_UNLOCK(&ifp->if_snd);
235			return;
236		}
237		IFQ_UNLOCK(&ifp->if_snd);
238	}
239
240	mtx_lock(&tp->tun_mtx);
241	if (tp->tun_flags & TUN_RWAIT) {
242		tp->tun_flags &= ~TUN_RWAIT;
243		wakeup(tp);
244	}
245	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
246		mtx_unlock(&tp->tun_mtx);
247		pgsigio(&tp->tun_sigio, SIGIO, 0);
248	} else
249		mtx_unlock(&tp->tun_mtx);
250	selwakeuppri(&tp->tun_rsel, PZERO + 1);
251}
252
253static void
254tuncreate(struct cdev *dev)
255{
256	struct tun_softc *sc;
257	struct ifnet *ifp;
258
259	dev->si_flags &= ~SI_CHEAPCLONE;
260
261	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
262	mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
263	sc->tun_flags = TUN_INITED;
264	sc->tun_dev = dev;
265	mtx_lock(&tunmtx);
266	TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
267	mtx_unlock(&tunmtx);
268
269	ifp = &sc->tun_if;
270	if_initname(ifp, TUNNAME, dev2unit(dev));
271	ifp->if_mtu = TUNMTU;
272	ifp->if_ioctl = tunifioctl;
273	ifp->if_output = tunoutput;
274	ifp->if_start = tunstart;
275	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
276	ifp->if_type = IFT_PPP;
277	ifp->if_softc = sc;
278	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
279	ifp->if_snd.ifq_drv_maxlen = 0;
280	IFQ_SET_READY(&ifp->if_snd);
281
282	if_attach(ifp);
283	bpfattach(ifp, DLT_NULL, sizeof(u_int));
284	dev->si_drv1 = sc;
285}
286
287static int
288tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
289{
290	struct ifnet	*ifp;
291	struct tun_softc *tp;
292
293	/*
294	 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
295	 * synchronization.
296	 */
297	tp = dev->si_drv1;
298	if (!tp) {
299		tuncreate(dev);
300		tp = dev->si_drv1;
301	}
302
303	/*
304	 * XXXRW: This use of tun_pid is subject to error due to the
305	 * fact that a reference to the tunnel can live beyond the
306	 * death of the process that created it.  Can we replace this
307	 * with a simple busy flag?
308	 */
309	mtx_lock(&tp->tun_mtx);
310	if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
311		mtx_unlock(&tp->tun_mtx);
312		return (EBUSY);
313	}
314	tp->tun_pid = td->td_proc->p_pid;
315
316	tp->tun_flags |= TUN_OPEN;
317	mtx_unlock(&tp->tun_mtx);
318	ifp = &tp->tun_if;
319	TUNDEBUG(ifp, "open\n");
320
321	return (0);
322}
323
324/*
325 * tunclose - close the device - mark i/f down & delete
326 * routing info
327 */
328static	int
329tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
330{
331	struct tun_softc *tp;
332	struct ifnet *ifp;
333	int s;
334
335	tp = dev->si_drv1;
336	ifp = &tp->tun_if;
337
338	mtx_lock(&tp->tun_mtx);
339	tp->tun_flags &= ~TUN_OPEN;
340	tp->tun_pid = 0;
341
342	/*
343	 * junk all pending output
344	 */
345	s = splimp();
346	IFQ_PURGE(&ifp->if_snd);
347	splx(s);
348	mtx_unlock(&tp->tun_mtx);
349
350	if (ifp->if_flags & IFF_UP) {
351		s = splimp();
352		if_down(ifp);
353		splx(s);
354	}
355
356	if (ifp->if_flags & IFF_RUNNING) {
357		struct ifaddr *ifa;
358
359		s = splimp();
360		/* find internet addresses and delete routes */
361		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
362			if (ifa->ifa_addr->sa_family == AF_INET)
363				/* Unlocked read. */
364				rtinit(ifa, (int)RTM_DELETE,
365				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
366		ifp->if_flags &= ~IFF_RUNNING;
367		splx(s);
368	}
369
370	funsetown(&tp->tun_sigio);
371	selwakeuppri(&tp->tun_rsel, PZERO + 1);
372	TUNDEBUG (ifp, "closed\n");
373	return (0);
374}
375
376static int
377tuninit(struct ifnet *ifp)
378{
379	struct tun_softc *tp = ifp->if_softc;
380	struct ifaddr *ifa;
381	int error = 0;
382
383	TUNDEBUG(ifp, "tuninit\n");
384
385	ifp->if_flags |= IFF_UP | IFF_RUNNING;
386	getmicrotime(&ifp->if_lastchange);
387
388	for (ifa = TAILQ_FIRST(&ifp->if_addrhead); ifa;
389	     ifa = TAILQ_NEXT(ifa, ifa_link)) {
390		if (ifa->ifa_addr == NULL)
391			error = EFAULT;
392			/* XXX: Should maybe return straight off? */
393		else {
394#ifdef INET
395			if (ifa->ifa_addr->sa_family == AF_INET) {
396			    struct sockaddr_in *si;
397
398			    si = (struct sockaddr_in *)ifa->ifa_addr;
399			    mtx_lock(&tp->tun_mtx);
400			    if (si->sin_addr.s_addr)
401				    tp->tun_flags |= TUN_IASET;
402
403			    si = (struct sockaddr_in *)ifa->ifa_dstaddr;
404			    if (si && si->sin_addr.s_addr)
405				    tp->tun_flags |= TUN_DSTADDR;
406			    mtx_unlock(&tp->tun_mtx);
407			}
408#endif
409		}
410	}
411	return (error);
412}
413
414/*
415 * Process an ioctl request.
416 */
417static int
418tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
419{
420	struct ifreq *ifr = (struct ifreq *)data;
421	struct tun_softc *tp = ifp->if_softc;
422	struct ifstat *ifs;
423	int		error = 0, s;
424
425	s = splimp();
426	switch(cmd) {
427	case SIOCGIFSTATUS:
428		ifs = (struct ifstat *)data;
429		mtx_lock(&tp->tun_mtx);
430		if (tp->tun_pid)
431			sprintf(ifs->ascii + strlen(ifs->ascii),
432			    "\tOpened by PID %d\n", tp->tun_pid);
433		mtx_unlock(&tp->tun_mtx);
434		break;
435	case SIOCSIFADDR:
436		error = tuninit(ifp);
437		TUNDEBUG(ifp, "address set, error=%d\n", error);
438		break;
439	case SIOCSIFDSTADDR:
440		error = tuninit(ifp);
441		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
442		break;
443	case SIOCSIFMTU:
444		ifp->if_mtu = ifr->ifr_mtu;
445		TUNDEBUG(ifp, "mtu set\n");
446		break;
447	case SIOCSIFFLAGS:
448	case SIOCADDMULTI:
449	case SIOCDELMULTI:
450		break;
451	default:
452		error = EINVAL;
453	}
454	splx(s);
455	return (error);
456}
457
458/*
459 * tunoutput - queue packets from higher level ready to put out.
460 */
461static int
462tunoutput(
463	struct ifnet *ifp,
464	struct mbuf *m0,
465	struct sockaddr *dst,
466	struct rtentry *rt)
467{
468	struct tun_softc *tp = ifp->if_softc;
469	u_short cached_tun_flags;
470	int error;
471
472	TUNDEBUG (ifp, "tunoutput\n");
473
474#ifdef MAC
475	error = mac_check_ifnet_transmit(ifp, m0);
476	if (error) {
477		m_freem(m0);
478		return (error);
479	}
480#endif
481
482	/* Could be unlocked read? */
483	mtx_lock(&tp->tun_mtx);
484	cached_tun_flags = tp->tun_flags;
485	mtx_unlock(&tp->tun_mtx);
486	if ((cached_tun_flags & TUN_READY) != TUN_READY) {
487		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
488		m_freem (m0);
489		return (EHOSTDOWN);
490	}
491
492	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
493		m_freem (m0);
494		return (EHOSTDOWN);
495	}
496
497	/* BPF write needs to be handled specially */
498	if (dst->sa_family == AF_UNSPEC) {
499		dst->sa_family = *(mtod(m0, int *));
500		m0->m_len -= sizeof(int);
501		m0->m_pkthdr.len -= sizeof(int);
502		m0->m_data += sizeof(int);
503	}
504
505	if (ifp->if_bpf) {
506		uint32_t af = dst->sa_family;
507		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
508	}
509
510	/* prepend sockaddr? this may abort if the mbuf allocation fails */
511	if (cached_tun_flags & TUN_LMODE) {
512		/* allocate space for sockaddr */
513		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
514
515		/* if allocation failed drop packet */
516		if (m0 == NULL) {
517			ifp->if_iqdrops++;
518			ifp->if_oerrors++;
519			return (ENOBUFS);
520		} else {
521			bcopy(dst, m0->m_data, dst->sa_len);
522		}
523	}
524
525	if (cached_tun_flags & TUN_IFHEAD) {
526		/* Prepend the address family */
527		M_PREPEND(m0, 4, M_DONTWAIT);
528
529		/* if allocation failed drop packet */
530		if (m0 == NULL) {
531			ifp->if_iqdrops++;
532			ifp->if_oerrors++;
533			return (ENOBUFS);
534		} else
535			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
536	} else {
537#ifdef INET
538		if (dst->sa_family != AF_INET)
539#endif
540		{
541			m_freem(m0);
542			return (EAFNOSUPPORT);
543		}
544	}
545
546	IFQ_HANDOFF(ifp, m0, error);
547	if (error) {
548		ifp->if_collisions++;
549		return (ENOBUFS);
550	}
551	ifp->if_opackets++;
552	return (0);
553}
554
555/*
556 * the cdevsw interface is now pretty minimal.
557 */
558static	int
559tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
560{
561	int		s;
562	int		error;
563	struct tun_softc *tp = dev->si_drv1;
564	struct tuninfo *tunp;
565
566	switch (cmd) {
567	case TUNSIFINFO:
568		tunp = (struct tuninfo *)data;
569		if (tunp->mtu < IF_MINMTU)
570			return (EINVAL);
571		if (tp->tun_if.if_mtu != tunp->mtu
572		&& (error = suser(td)) != 0)
573			return (error);
574		tp->tun_if.if_mtu = tunp->mtu;
575		tp->tun_if.if_type = tunp->type;
576		tp->tun_if.if_baudrate = tunp->baudrate;
577		break;
578	case TUNGIFINFO:
579		tunp = (struct tuninfo *)data;
580		tunp->mtu = tp->tun_if.if_mtu;
581		tunp->type = tp->tun_if.if_type;
582		tunp->baudrate = tp->tun_if.if_baudrate;
583		break;
584	case TUNSDEBUG:
585		tundebug = *(int *)data;
586		break;
587	case TUNGDEBUG:
588		*(int *)data = tundebug;
589		break;
590	case TUNSLMODE:
591		mtx_lock(&tp->tun_mtx);
592		if (*(int *)data) {
593			tp->tun_flags |= TUN_LMODE;
594			tp->tun_flags &= ~TUN_IFHEAD;
595		} else
596			tp->tun_flags &= ~TUN_LMODE;
597		mtx_unlock(&tp->tun_mtx);
598		break;
599	case TUNSIFHEAD:
600		mtx_lock(&tp->tun_mtx);
601		if (*(int *)data) {
602			tp->tun_flags |= TUN_IFHEAD;
603			tp->tun_flags &= ~TUN_LMODE;
604		} else
605			tp->tun_flags &= ~TUN_IFHEAD;
606		mtx_unlock(&tp->tun_mtx);
607		break;
608	case TUNGIFHEAD:
609		/* Could be unlocked read? */
610		mtx_lock(&tp->tun_mtx);
611		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
612		mtx_unlock(&tp->tun_mtx);
613		break;
614	case TUNSIFMODE:
615		/* deny this if UP */
616		if (tp->tun_if.if_flags & IFF_UP)
617			return(EBUSY);
618
619		switch (*(int *)data & ~IFF_MULTICAST) {
620		case IFF_POINTOPOINT:
621		case IFF_BROADCAST:
622			tp->tun_if.if_flags &=
623			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
624			tp->tun_if.if_flags |= *(int *)data;
625			break;
626		default:
627			return(EINVAL);
628		}
629		break;
630	case TUNSIFPID:
631		mtx_lock(&tp->tun_mtx);
632		tp->tun_pid = curthread->td_proc->p_pid;
633		mtx_unlock(&tp->tun_mtx);
634		break;
635	case FIONBIO:
636		break;
637	case FIOASYNC:
638		mtx_lock(&tp->tun_mtx);
639		if (*(int *)data)
640			tp->tun_flags |= TUN_ASYNC;
641		else
642			tp->tun_flags &= ~TUN_ASYNC;
643		mtx_unlock(&tp->tun_mtx);
644		break;
645	case FIONREAD:
646		s = splimp();
647		if (!IFQ_IS_EMPTY(&tp->tun_if.if_snd)) {
648			struct mbuf *mb;
649			IFQ_LOCK(&tp->tun_if.if_snd);
650			IFQ_POLL_NOLOCK(&tp->tun_if.if_snd, mb);
651			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
652				*(int *)data += mb->m_len;
653			IFQ_UNLOCK(&tp->tun_if.if_snd);
654		} else
655			*(int *)data = 0;
656		splx(s);
657		break;
658	case FIOSETOWN:
659		return (fsetown(*(int *)data, &tp->tun_sigio));
660
661	case FIOGETOWN:
662		*(int *)data = fgetown(&tp->tun_sigio);
663		return (0);
664
665	/* This is deprecated, FIOSETOWN should be used instead. */
666	case TIOCSPGRP:
667		return (fsetown(-(*(int *)data), &tp->tun_sigio));
668
669	/* This is deprecated, FIOGETOWN should be used instead. */
670	case TIOCGPGRP:
671		*(int *)data = -fgetown(&tp->tun_sigio);
672		return (0);
673
674	default:
675		return (ENOTTY);
676	}
677	return (0);
678}
679
680/*
681 * The cdevsw read interface - reads a packet at a time, or at
682 * least as much of a packet as can be read.
683 */
684static	int
685tunread(struct cdev *dev, struct uio *uio, int flag)
686{
687	struct tun_softc *tp = dev->si_drv1;
688	struct ifnet	*ifp = &tp->tun_if;
689	struct mbuf	*m;
690	int		error=0, len, s;
691
692	TUNDEBUG (ifp, "read\n");
693	mtx_lock(&tp->tun_mtx);
694	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
695		mtx_unlock(&tp->tun_mtx);
696		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
697		return (EHOSTDOWN);
698	}
699
700	tp->tun_flags &= ~TUN_RWAIT;
701	mtx_unlock(&tp->tun_mtx);
702
703	s = splimp();
704	do {
705		IFQ_DEQUEUE(&ifp->if_snd, m);
706		if (m == NULL) {
707			if (flag & O_NONBLOCK) {
708				splx(s);
709				return (EWOULDBLOCK);
710			}
711			mtx_lock(&tp->tun_mtx);
712			tp->tun_flags |= TUN_RWAIT;
713			mtx_unlock(&tp->tun_mtx);
714			if((error = tsleep(tp, PCATCH | (PZERO + 1),
715					"tunread", 0)) != 0) {
716				splx(s);
717				return (error);
718			}
719		}
720	} while (m == NULL);
721	splx(s);
722
723	while (m && uio->uio_resid > 0 && error == 0) {
724		len = min(uio->uio_resid, m->m_len);
725		if (len != 0)
726			error = uiomove(mtod(m, void *), len, uio);
727		m = m_free(m);
728	}
729
730	if (m) {
731		TUNDEBUG(ifp, "Dropping mbuf\n");
732		m_freem(m);
733	}
734	return (error);
735}
736
737/*
738 * the cdevsw write interface - an atomic write is a packet - or else!
739 */
740static	int
741tunwrite(struct cdev *dev, struct uio *uio, int flag)
742{
743	struct tun_softc *tp = dev->si_drv1;
744	struct ifnet	*ifp = &tp->tun_if;
745	struct mbuf	*m;
746	int		error = 0;
747	uint32_t	family;
748	int 		isr;
749
750	TUNDEBUG(ifp, "tunwrite\n");
751
752	if ((ifp->if_flags & IFF_UP) != IFF_UP)
753		/* ignore silently */
754		return (0);
755
756	if (uio->uio_resid == 0)
757		return (0);
758
759	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
760		TUNDEBUG(ifp, "len=%d!\n", uio->uio_resid);
761		return (EIO);
762	}
763
764	if ((m = m_uiotombuf(uio, M_DONTWAIT, 0)) == NULL) {
765		ifp->if_ierrors++;
766		return (error);
767	}
768
769	m->m_pkthdr.rcvif = ifp;
770#ifdef MAC
771	mac_create_mbuf_from_ifnet(ifp, m);
772#endif
773
774	/* Could be unlocked read? */
775	mtx_lock(&tp->tun_mtx);
776	if (tp->tun_flags & TUN_IFHEAD) {
777		mtx_unlock(&tp->tun_mtx);
778		if (m->m_len < sizeof(family) &&
779		    (m = m_pullup(m, sizeof(family))) == NULL)
780			return (ENOBUFS);
781		family = ntohl(*mtod(m, u_int32_t *));
782		m_adj(m, sizeof(family));
783	} else {
784		mtx_unlock(&tp->tun_mtx);
785		family = AF_INET;
786	}
787
788	BPF_MTAP2(ifp, &family, sizeof(family), m);
789
790	switch (family) {
791#ifdef INET
792	case AF_INET:
793		isr = NETISR_IP;
794		break;
795#endif
796#ifdef INET6
797	case AF_INET6:
798		isr = NETISR_IPV6;
799		break;
800#endif
801#ifdef IPX
802	case AF_IPX:
803		isr = NETISR_IPX;
804		break;
805#endif
806#ifdef NETATALK
807	case AF_APPLETALK:
808		isr = NETISR_ATALK2;
809		break;
810#endif
811	default:
812		m_freem(m);
813		return (EAFNOSUPPORT);
814	}
815	/* First chunk of an mbuf contains good junk */
816	if (harvest.point_to_point)
817		random_harvest(m, 16, 3, 0, RANDOM_NET);
818	ifp->if_ibytes += m->m_pkthdr.len;
819	ifp->if_ipackets++;
820	netisr_dispatch(isr, m);
821	return (0);
822}
823
824/*
825 * tunpoll - the poll interface, this is only useful on reads
826 * really. The write detect always returns true, write never blocks
827 * anyway, it either accepts the packet or drops it.
828 */
829static	int
830tunpoll(struct cdev *dev, int events, struct thread *td)
831{
832	int		s;
833	struct tun_softc *tp = dev->si_drv1;
834	struct ifnet	*ifp = &tp->tun_if;
835	int		revents = 0;
836	struct mbuf	*m;
837
838	s = splimp();
839	TUNDEBUG(ifp, "tunpoll\n");
840
841	if (events & (POLLIN | POLLRDNORM)) {
842		IFQ_LOCK(&ifp->if_snd);
843		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
844		if (m != NULL) {
845			TUNDEBUG(ifp, "tunpoll q=%d\n", ifp->if_snd.ifq_len);
846			revents |= events & (POLLIN | POLLRDNORM);
847		} else {
848			TUNDEBUG(ifp, "tunpoll waiting\n");
849			selrecord(td, &tp->tun_rsel);
850		}
851		IFQ_UNLOCK(&ifp->if_snd);
852	}
853	if (events & (POLLOUT | POLLWRNORM))
854		revents |= events & (POLLOUT | POLLWRNORM);
855
856	splx(s);
857	return (revents);
858}
859